fix discord and 1pass dock link

Flake lock file updates:

• Updated input 'darwin':
    'github:lnl7/nix-darwin/a4cf1d10853b0d2be19b9eca35d749e201d70b55' (2026-07-15)
  → 'github:lnl7/nix-darwin/57a3171f94705599a2499248ca5758d5eb47c0e0' (2026-07-19)
• Updated input 'home-manager':
    'github:nix-community/home-manager/460108009ca1ff69ca2ff19079ca2c838d6e3080' (2026-07-18)
  → 'github:nix-community/home-manager/079a3b5d1aa6a719920a51316253b7d6dd22738d' (2026-07-24)
• Updated input 'nix-caddy-withplugins':
    'github:MichailiK/nix-caddy-withplugins/79db67d97207b6e32eaba69d5c3e6d7e63144154' (2026-06-14)
  → 'github:MichailiK/nix-caddy-withplugins/70307cfc568e5434cf42067d797b27c38ea69944' (2026-07-24)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/753cc8a3a87467296ddd1fa93f0cc3e81120ee46' (2026-07-15)
  → 'github:nixos/nixpkgs/e2587caef70cea85dd97d7daab492899902dbf5d' (2026-07-23)
• Updated input 'nixpkgs-stable':
    'github:nixos/nixpkgs/293d6abedf0478e681a4dfcfcb35b30fc796a32f' (2026-07-17)
  → 'github:nixos/nixpkgs/b3fe9581c9061c749abef42b6d4ee7b7c05c33fa' (2026-07-22)
• Updated input 'nur':
    'github:nix-community/nur/697f13fd230047493989b03576419792273c3a9e' (2026-07-18)
  → 'github:nix-community/nur/1166a294990afd245fd72b8d2896075222408399' (2026-07-25)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/3c38e1e1ba9c8d7030f7b5a801398ea7d8a6fdc0' (2026-07-18)
  → 'github:oxalica/rust-overlay/a163bd01a6e11ac58d4f8d11669da550b5afbbc6' (2026-07-25)
• Updated input 'wsl':
    'github:nix-community/NixOS-WSL/24c8dc8e0f2170e1a377be24dfadc7d9d21dc1ad' (2026-07-14)
  → 'github:nix-community/NixOS-WSL/eaeb18da90024448a60eb1ec7132eafa4003404e' (2026-07-21)

docs/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## 2026-07-20
+
+- Added `overlays/paho-mqtt.nix` to disable paho-mqtt's flaky, socket-based
+  test suite. Its `checkPhase` hangs in the Nix sandbox and times out with a
+  `KeyboardInterrupt` after ~150s, which was breaking the `flame` rebuild
+  (paho-mqtt is pulled in transitively, e.g. via mealie). The override is
+  applied through `pythonPackagesExtensions` so it covers every Python
+  package set.

flake.lock

@@ -8,11 +8,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1766810506,
-        "narHash": "sha256-I4BxozsEu205tA7jazufztI8ZQ5p7hcCnjqrSKPz9nI=",
+        "lastModified": 1782994178,
+        "narHash": "sha256-VGc3/2fe6hnOmNSLlOygEAbeS69v7A7rjKDKRzAgE2Q=",
         "owner": "hraban",
         "repo": "cl-nix-lite",
-        "rev": "038e341cede255a83a8f04af114dc95717461d32",
+        "rev": "eb584721e5e799bafe0c6210a8a1a398f90e8ac0",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781242433,
-        "narHash": "sha256-bchLZZ3sRn740zyvD2icZSnNoTaanN0nw7l6fjVXO+E=",
+        "lastModified": 1784500460,
+        "narHash": "sha256-UvORnAxTRHax7RG74W8Z2t4GvIkX6AjJ5kk0QlwZomo=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "aabb2037edfc0f210723b72cd5f528aab5dd3f0b",
+        "rev": "57a3171f94705599a2499248ca5758d5eb47c0e0",
         "type": "github"
       },
       "original": {
@@ -65,11 +65,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1730663653,
-        "narHash": "sha256-kFCUWettiFHDIqxCWWQ9qY8pVh+Lj+XL0Giyy/kdomg=",
+        "lastModified": 1766808011,
+        "narHash": "sha256-s83BS0abtIj7vzUf8JE0209KphfHA6qRw/92D9k/F+0=",
         "owner": "hraban",
         "repo": "flake-compat",
-        "rev": "e5b16676185cb7548581c852f51ce7f3a49bba5e",
+        "rev": "6e0aafdc4c4c2043c66f756d5045374b42184fc5",
         "type": "github"
       },
       "original": {
@@ -80,6 +80,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -179,11 +195,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781305496,
-        "narHash": "sha256-g8Vv4Qfc7n+lgov97REu3X6BeJtvYY0hlSUZR1GrGQQ=",
+        "lastModified": 1784913159,
+        "narHash": "sha256-JWq0BfjO4ktpH5USfQNQzdvHpIDT8fSKD5K7LvdMRFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c87a39aa979acc4848016d2220c6238390d84779",
+        "rev": "079a3b5d1aa6a719920a51316253b7d6dd22738d",
         "type": "github"
       },
       "original": {
@@ -203,11 +219,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1766810876,
-        "narHash": "sha256-VPElWFQIiP31lXQXEom+L4sl85alZpZn33O4hewsP9k=",
+        "lastModified": 1783182903,
+        "narHash": "sha256-7IteXipJZfFepi5zakxe0jQ5i3vRBQguk0+Gtte1Fu4=",
         "owner": "hraban",
         "repo": "mac-app-util",
-        "rev": "4747968574ea58512c5385466400b2364c85d2d0",
+        "rev": "039f33deef21782d4db97087f426504951239887",
         "type": "github"
       },
       "original": {
@@ -216,6 +232,26 @@
         "type": "github"
       }
     },
+    "nix-caddy-withplugins": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_5"
+      },
+      "locked": {
+        "lastModified": 1784936738,
+        "narHash": "sha256-X4w9BrFkisfzla3m1WwDJUicUbI7JRdhzq5aS7rrB0k=",
+        "owner": "MichailiK",
+        "repo": "nix-caddy-withplugins",
+        "rev": "70307cfc568e5434cf42067d797b27c38ea69944",
+        "type": "github"
+      },
+      "original": {
+        "owner": "MichailiK",
+        "ref": "nixos-unstable",
+        "repo": "nix-caddy-withplugins",
+        "type": "github"
+      }
+    },
     "nix2vim": {
       "inputs": {
         "flake-utils": "flake-utils_2",
@@ -275,11 +311,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766736597,
-        "narHash": "sha256-BASnpCLodmgiVn0M1MU2Pqyoz0aHwar/0qLkp7CjvSQ=",
+        "lastModified": 1779796641,
+        "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f560ccec6b1116b22e6ed15f4c510997d99d5852",
+        "rev": "25f538306313eae3927264466c70d7001dcea1df",
         "type": "github"
       },
       "original": {
@@ -306,11 +342,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1780902259,
-        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
+        "lastModified": 1784707089,
+        "narHash": "sha256-2V/6imsUgB7mPZlHY54oeVBRDoZbPKnvzwkAHUSSufk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
+        "rev": "b3fe9581c9061c749abef42b6d4ee7b7c05c33fa",
         "type": "github"
       },
       "original": {
@@ -338,27 +374,27 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1732617236,
-        "narHash": "sha256-PYkz6U0bSEaEB1al7O1XsqVNeSNS+s3NVclJw7YC43w=",
+        "lastModified": 1782999065,
+        "narHash": "sha256-5Dgj5+pIQYZKrXUGaLCk7CKfN3MmpwIhO94++WVxvng=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "af51545ec9a44eadf3fe3547610a5cdd882bc34e",
+        "rev": "80d591ed473cfc46329932c2aadac9b435342c7c",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
-        "rev": "af51545ec9a44eadf3fe3547610a5cdd882bc34e",
         "type": "github"
       }
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1761236834,
-        "narHash": "sha256-+pthv6hrL5VLW2UqPdISGuLiUZ6SnAXdd2DdUE+fV2Q=",
+        "lastModified": 1770107345,
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d5faa84122bc0a1fd5d378492efce4e289f8eac1",
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
         "type": "github"
       },
       "original": {
@@ -372,11 +408,27 @@
       "locked": {
         "lastModified": 1781074563,
         "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
         "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
         "type": "github"
       },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "type": "github"
+      },
       "original": {
         "owner": "nixos",
         "ref": "nixos-unstable",
@@ -384,7 +436,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_6": {
+    "nixpkgs_7": {
       "locked": {
         "lastModified": 1744536153,
         "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
@@ -408,11 +460,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781332612,
-        "narHash": "sha256-io6pa4M5rNg+86HWT8iAd4HjnhXmZz5iqJtYS14tVyk=",
+        "lastModified": 1784959021,
+        "narHash": "sha256-Atc5ydxAmAAD5o8e6F8VVxVCOQb82bqi5TRNRUSBvZU=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "d093785742fb74b13a61ca54060206da54f782d0",
+        "rev": "1166a294990afd245fd72b8d2896075222408399",
         "type": "github"
       },
       "original": {
@@ -427,9 +479,10 @@
         "disko": "disko",
         "home-manager": "home-manager",
         "mac-app-util": "mac-app-util",
+        "nix-caddy-withplugins": "nix-caddy-withplugins",
         "nix2vim": "nix2vim",
         "nixos-generators": "nixos-generators",
-        "nixpkgs": "nixpkgs_5",
+        "nixpkgs": "nixpkgs_6",
         "nixpkgs-stable": "nixpkgs-stable",
         "nur": "nur",
         "rust-overlay": "rust-overlay",
@@ -440,14 +493,14 @@
     },
     "rust-overlay": {
       "inputs": {
-        "nixpkgs": "nixpkgs_6"
+        "nixpkgs": "nixpkgs_7"
       },
       "locked": {
-        "lastModified": 1781320681,
-        "narHash": "sha256-mjJ/VxJaIkgcUvKANgKOaaN5M1X1X+6NjCP0C5hw0WI=",
+        "lastModified": 1784956772,
+        "narHash": "sha256-5polVWDhgATIQj+RUV2ZlOd5nE6cGJo+C4tOEs5vp6U=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "5b929d8c854149d926d05ea0cd6469bf4e54db27",
+        "rev": "a163bd01a6e11ac58d4f8d11669da550b5afbbc6",
         "type": "github"
       },
       "original": {
@@ -539,11 +592,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1766000401,
-        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {
@@ -554,17 +607,17 @@
     },
     "wsl": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1781182279,
-        "narHash": "sha256-V5EQQbDnmdiXGQXrEF1PEL7QYsFqfH8N1E89Z5ONwFk=",
+        "lastModified": 1784642409,
+        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "5675822ba756e6e56f8f6a5a76e90e0da2ece94d",
+        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
         "type": "github"
       },
       "original": {
@@ -584,11 +637,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1742588229,
-        "narHash": "sha256-IPg0pBw0ciF+xl6viq3nK+dvZoDZrfBDui7dkPLz258=",
+        "lastModified": 1781873766,
+        "narHash": "sha256-V8baEgRBa2SqtCLbQ4EaphIMKsnAogY2oMdttWYhkEs=",
         "owner": "mostafaqanbaryan",
         "repo": "zellij-switch",
-        "rev": "0e3c303c19890ccb03589230ac5a7c4307e573e4",
+        "rev": "ced3c681afe40785b2853e3a976908466786ee79",
         "type": "github"
       },
       "original": {

flake.nix

@@ -40,6 +40,12 @@
       # inputs.nixpkgs.follows = "nixpkgs"; # Use system packages list for their inputs
     };
 
+    # Caddy with decoupled plugin hashes
+    nix-caddy-withplugins = {
+      url = "github:MichailiK/nix-caddy-withplugins/nixos-unstable";
+      # Important: Do not follow nixpkgs here, per the README
+    };
+
     # Manage disk format and partitioning
     disko = {
       url = "github:nix-community/disko";

hosts/aarch64-darwin/lookingglass/default.nix

@@ -12,9 +12,9 @@ rec {
 
   nmasur.profiles = {
     base.enable = true;
-    work.enable = true;
-    extra.enable = true;
-    gaming.enable = true;
+    # work.enable = true;
+    # extra.enable = true;
+    # gaming.enable = true;
   };
 
   home-manager.users."Noah.Masur" = {
@@ -26,6 +26,8 @@ rec {
     nmasur.profiles = {
       common.enable = true;
       darwin-base.enable = true;
+      darwin-gaming.enable = true;
+      llm-development.enable = true;
       power-user.enable = true;
       work.enable = true;
       experimental.enable = true;

hosts/aarch64-linux/flame/default.nix

@@ -28,6 +28,7 @@ rec {
     nmasur.profiles = {
       common.enable = true;
       linux-base.enable = true;
+      llm-development.enable = true;
       power-user.enable = true;
     };
     nmasur.presets.programs.helix.enable = true;

hosts/x86_64-linux/swan/default.nix

@@ -26,6 +26,7 @@ rec {
     nmasur.profiles = {
       common.enable = true;
       linux-base.enable = true;
+      llm-development.enable = true;
       power-user.enable = true;
     };
     home.stateVersion = "23.05";

hosts/x86_64-linux/tempest/default.nix

@@ -30,6 +30,7 @@ rec {
       linux-base.enable = true;
       linux-gui.enable = true;
       linux-gaming.enable = true;
+      llm-development.enable = true;
       power-user.enable = true;
       developer.enable = true;
       experimental.enable = true;

lib/default.nix

@@ -66,7 +66,9 @@ lib
   overlays = [
     inputs.nur.overlays.default
     inputs.nix2vim.overlay
-    inputs.zellij-switch.overlays.default
+    (final: prev: {
+      zellij-switch = inputs.zellij-switch.packages.${prev.stdenv.hostPlatform.system}.default;
+    })
     # inputs.helix.overlays.default
   ]
   ++ (importOverlays ../overlays);
@@ -101,6 +103,9 @@ lib
       config.permittedInsecurePackages = [
         "litestream-0.3.13"
         "electron-36.9.5"
+        # Build-time-only dep of karakeep's frontend; CVEs don't reach
+        # the runtime closure. Remove once nixpkgs bumps it.
+        "pnpm-9.15.9"
       ];
       config.allowUnfree = true;
     }
@@ -174,22 +179,20 @@ lib
     inputs.darwin.lib.darwinSystem {
       inherit system specialArgs;
       modules = [
-        inputs.home-manager.darwinModules.home-manager
         inputs.mac-app-util.darwinModules.default
         {
           imports = (nixFiles ../platforms/nix-darwin);
           nixpkgs.pkgs = pkgsBySystem.${system};
         }
-        module
-        {
-          home-manager = {
-            extraSpecialArgs = {
-              inherit colorscheme;
-            }
-            // specialArgs;
-          }
-          // homeModule.home-manager;
-        }
+        # Home Manager is intentionally NOT activated here. It is managed
+        # standalone via `nh home switch` (see homeConfigurations, extracted
+        # from the host module's `home-manager.users`). Strip that attr so
+        # darwin-rebuild doesn't also activate a second, divergent HM
+        # generation with different store paths (useUserPackages puts packages
+        # in /etc/profiles/per-user vs. ~/.nix-profile standalone) -- that
+        # mismatch broke the prompt after every darwin-rebuild until the next
+        # `nh home switch`.
+        (builtins.removeAttrs module [ "home-manager" ])
       ];
     };
 

modules/common/shell/work.nix

@@ -1,67 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-{
-
-  home-manager.users.${config.user} = lib.mkIf pkgs.stdenv.isDarwin {
-
-    home.packages =
-      let
-        ldap_scheme = "ldaps";
-        magic_prefix = "take";
-        ldap_port = 3269;
-        jq_parse = pkgs.writeShellScriptBin "ljq" ''
-          jq --slurp \
-            --raw-input 'split("\n\n")|map(split("\n")|map(select(.[0:1]!="#" and length>0)) |select(length > 0)|map(capture("^(?<key>[^:]*:?): *(?<value>.*)") |if .key[-1:.key|length] == ":" then .key=.key[0:-1]|.value=(.value|@base64d) else . end)| group_by(.key) | map({key:.[0].key,value:(if .|length > 1 then [.[].value] else .[].value end)}) | from_entries)' | jq -r 'del(.[].thumbnailPhoto)'
-        '';
-        ldap_script = pkgs.writeShellScriptBin "ldap" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          SEARCH_FILTER="$@"
-          ldapsearch -LLL \
-              -B -o ldif-wrap=no \
-              -E pr=5000/prompt \
-              -H "${ldap_scheme}://''${LDAP_HOST}:${builtins.toString ldap_port}" \
-              -D "${pkgs.lib.toUpper magic_prefix}2\\${pkgs.lib.toLower config.user}" \
-              -w "$(${pkgs._1password-cli}/bin/op item get T2 --fields label=password --reveal)" \
-              -b "dc=''${LDAP_HOST//./,dc=}" \
-              -s "sub" -x "(cn=''${SEARCH_FILTER})" \
-              | ${jq_parse}/bin/ljq
-        '';
-        ldapm_script = pkgs.writeShellScriptBin "ldapm" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "$@" | jq '[ .[].memberOf] | add'
-        '';
-        ldapg_script = pkgs.writeShellScriptBin "ldapg" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "$@" | jq '[ .[].member] | add'
-        '';
-        ldapl_script = pkgs.writeShellScriptBin "ldapl" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "*$@*" | jq -r '.[].name'
-        '';
-      in
-      [
-        ldap_script
-        ldapm_script
-        ldapg_script
-        ldapl_script
-        jq_parse
-      ];
-  };
-}

modules/darwin/homebrew.nix

@@ -1,56 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-
-  # Homebrew - Mac-specific packages that aren't in Nix
-  config = lib.mkIf pkgs.stdenv.isDarwin {
-
-    # # Requires Homebrew to be installed
-    system.activationScripts.preActivation.text = ''
-      if ! xcode-select --version 2>/dev/null; then
-        $DRY_RUN_CMD xcode-select --install
-      fi
-      if ! /opt/homebrew/bin/brew --version 2>/dev/null; then
-        $DRY_RUN_CMD /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-      fi
-    '';
-
-    # Add homebrew paths to CLI path
-    home-manager.users.${config.user}.home.sessionPath = [
-      "/opt/homebrew/bin/"
-      "/opt/homebrew/opt/trash/bin/"
-    ];
-
-    homebrew = {
-      enable = true;
-      onActivation = {
-        autoUpdate = false; # Don't update during rebuild
-        cleanup = "zap"; # Uninstall all programs not declared
-        upgrade = true;
-      };
-      global = {
-        brewfile = true; # Run brew bundle from anywhere
-      };
-      brews = [
-        "trash" # Delete files and folders to trash instead of rm
-        "jiratui" # Terminal program to manage Jira
-      ];
-      casks = [
-        "1password" # 1Password will not launch from Nix on macOS
-        # "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
-        "keybase" # GUI on Nix not available for macOS
-        # "logitech-g-hub" # Mouse and keyboard management
-        "logitune" # Logitech webcam firmware
-        "meetingbar" # Show meetings in menu bar
-        "scroll-reverser" # Different scroll style for mouse vs. trackpad
-        "notunes" # Don't launch Apple Music with the play button
-        "steam" # Not packaged for Nixon macOS
-        "epic-games" # Not packaged for Nix
-      ];
-    };
-  };
-}

overlays/kubernetes-helm.nix

@@ -0,0 +1,7 @@
+_inputs: _final: prev: {
+
+  kubernetes-helm = prev.kubernetes-helm.overrideAttrs (_old: {
+    doCheck = false;
+  });
+
+}

overlays/nix-caddy-withplugins.nix

@@ -0,0 +1 @@
+inputs: inputs.nix-caddy-withplugins.overlays.default

overlays/paho-mqtt.nix

@@ -0,0 +1,20 @@
+# Disable paho-mqtt's flaky test suite.
+#
+# paho-mqtt's checkPhase runs socket-based integration tests that hang in
+# the Nix sandbox (they eventually time out with a KeyboardInterrupt after
+# ~150s, reporting errors and failing the build). This breaks the flame
+# rebuild, where paho-mqtt is pulled in transitively (e.g. via mealie).
+#
+# Applied through pythonPackagesExtensions so it covers every Python
+# package set (python3Packages, python314Packages, ...).
+
+_inputs: _final: prev: {
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (_pyfinal: pyprev: {
+      paho-mqtt = pyprev.paho-mqtt.overridePythonAttrs (_old: {
+        doCheck = false;
+        doInstallCheck = false;
+      });
+    })
+  ];
+}

pkgs/caddy/package.nix

@@ -2,21 +2,10 @@
 
 {
   pkgs,
-  fetchFromGitHub,
   ...
 }:
 
-# Maintain a static version so that the plugin hash doesn't keep breaking
-(pkgs.caddy.overrideAttrs rec {
-  version = "2.10.2";
-  src = fetchFromGitHub {
-    owner = "caddyserver";
-    repo = "caddy";
-    tag = "v${version}";
-    hash = "sha256-KvikafRYPFZ0xCXqDdji1rxlkThEDEOHycK8GP5e8vk=";
-  };
-}).withPlugins
-  {
+pkgs.caddy.withPlugins {
   plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-    hash = "sha256-xz43pXTsnYmXZDAAUT+vTapoq3O/8br7igGwqZbjFdk=";
+  hash = "sha256-HuVBmiT3kD6RrDejQ6SnjCN8f7pFdZlGtZFbEf47bks=";
 }

pkgs/mathesar/package.nix

@@ -89,6 +89,13 @@ let
         drf-access-policy
         # psycopg-binary
         ;
+      # clevercsv's test_encoding_chardet is nondeterministic (chardet
+      # returns None instead of ISO-8859-1/KOI8-R on some platforms),
+      # breaking the build. Skip its test suite.
+      clevercsv = pyprev.clevercsv.overridePythonAttrs (_old: {
+        doCheck = false;
+        doInstallCheck = false;
+      });
     };
   };
 

platforms/home-manager/modules/nmasur/presets/programs/aerc.nix

@@ -202,6 +202,9 @@ in
       };
     };
 
+    # Used for macOS
+    xdg.enable = lib.mkDefault pkgs.stdenv.isDarwin;
+
     xdg.desktopEntries.aerc = lib.mkIf (pkgs.stdenv.isLinux) {
       name = "aerc";
       exec = "${lib.getExe config.nmasur.presets.services.i3.terminal} -e aerc %u";

platforms/home-manager/modules/nmasur/presets/programs/cargo.nix

@@ -18,16 +18,16 @@ in
       ca = "cargo";
     };
 
-    home.packages = with pkgs; [
-      gcc
-      rustc
-      cargo
-      cargo-watch
-      clippy
-      rustfmt
-      pkg-config
-      openssl
-      rust-analyzer
+    home.packages = [
+      pkgs.gcc
+      pkgs.rustc
+      pkgs.cargo
+      pkgs.stable.cargo-watch
+      pkgs.clippy
+      pkgs.rustfmt
+      pkgs.pkg-config
+      pkgs.openssl
+      pkgs.rust-analyzer
     ];
   };
 }

platforms/home-manager/modules/nmasur/presets/programs/fish-darwin.nix

@@ -13,13 +13,35 @@ in
 
   options.nmasur.presets.programs.fish-darwin.enable = lib.mkEnableOption {
     description = "Fish macOS options";
-    default = config.nmasur.presets.programs.fish && pkgs.stdenv.isDarwin;
   };
 
   config = lib.mkIf cfg.enable {
-    programs.fish.shellAbbrs = {
+    # Default shell setting doesn't work
+    home.sessionVariables = {
+      SHELL = "${pkgs.fish}/bin/fish";
+    };
+
+    programs.fish = {
+      shellAbbrs = {
         # Shortcut to edit hosts file
-      hosts = "sudo nvim /etc/hosts";
+        hosts = "sudo hx /etc/hosts";
+      };
+      shellInit = ''
+        set -g __nixos_path_original $PATH
+        function __nixos_path_fix -d "fix PATH value"
+          set -l result (string split ":" $__nixos_path_original)
+          for elt in $PATH
+            if not contains -- $elt $result
+              set -a result $elt
+            end
+          end
+          set -g PATH $result
+        end
+        __nixos_path_fix
+      '';
+
+      # # Speeds up fish launch time on macOS
+      # useBabelfish = true;
     };
   };
 }

platforms/home-manager/modules/nmasur/presets/programs/ghostty.nix

@@ -16,13 +16,12 @@ in
   config = lib.mkIf cfg.enable {
 
     # Set the i3 terminal
-    nmasur.presets.services.i3.terminal =
-      if pkgs.stdenv.isDarwin then pkgs.alacritty else config.programs.ghostty.package;
+    nmasur.presets.services.i3.terminal = config.programs.ghostty.package;
 
     programs.ghostty = {
       enable = true;
 
-      package = if pkgs.stdenv.isDarwin then null else pkgs.ghostty;
+      package = if pkgs.stdenv.isDarwin then pkgs.ghostty-bin else pkgs.ghostty;
 
       enableFishIntegration = true;
       enableBashIntegration = true;
@@ -38,8 +37,8 @@ in
         fullscreen = if pkgs.stdenv.isDarwin then true else false;
         keybind = [
           "super+t=unbind" # Pass super-t to underlying tool (e.g. zellij tabs)
-          "super+shift+bracket_right=unbind"
-          "super+shift+bracket_left=unbind"
+          "super+shift+]=unbind"
+          "super+shift+[=unbind"
           "ctrl+tab=unbind"
           "ctrl+shift+tab=unbind"
           "ctrl+tab=text:\\x1b[9;5u"

platforms/home-manager/modules/nmasur/presets/programs/git-work.nix

@@ -39,8 +39,19 @@ in
   config = lib.mkIf cfg.enable {
 
     programs.git = {
-      settings.user.name = lib.mkForce cfg.work.name;
-      settings.user.email = lib.mkForce cfg.work.email;
+      settings = {
+        user = {
+          name = lib.mkForce cfg.work.name;
+          email = lib.mkForce cfg.work.email;
+          signingKey = "~/.ssh/work_github";
+        };
+        commit = {
+          gpgsign = true;
+        };
+        tag = {
+          gpgsign = true;
+        };
+      };
       includes = [
         {
           path = "${config.home.homeDirectory}/${config.xdg.configFile."git/personal".target}";
@@ -50,6 +61,11 @@ in
 
     };
 
+    # Add work to signers file
+    xdg.configFile."git/allowed-signers".text = ''
+      ${cfg.work.email} ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIP7aXbmKHmWUZgwG5HPtwx+nREVeMIRplpAAzxPOFXL
+    '';
+
     # Personal git config
     xdg.configFile."git/personal".text = lib.generators.toGitINI {
       user = {
@@ -57,12 +73,6 @@ in
         email = cfg.personal.email;
         signingkey = "~/.ssh/id_ed25519";
       };
-      commit = {
-        gpgsign = true;
-      };
-      tag = {
-        gpgsign = true;
-      };
     };
 
     # Personal jj config

platforms/home-manager/modules/nmasur/presets/programs/git/default.nix

@@ -65,7 +65,7 @@ in
     };
 
     xdg.configFile."git/allowed-signers".text = ''
-      7386960+nmasur@users.noreply.github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s
+      ${config.nmasur.presets.programs.git.email} ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s
     '';
 
     programs.fish.shellAbbrs = {

platforms/home-manager/modules/nmasur/presets/programs/homebrew.nix

@@ -0,0 +1,83 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.programs.homebrew;
+in
+
+{
+
+  options.nmasur.presets.programs.homebrew.enable =
+    lib.mkEnableOption "Homebrew macOS package manager";
+
+  config = lib.mkIf cfg.enable {
+
+    home.file.".Brewfile".text = /* homebrew */ ''
+      # Taps
+      # tap "homebrew/bundle"
+
+      # Brews (CLI Apps)
+      brew "trash" # Delete files and folders to trash instead of rm
+
+      # Casks (GUI Apps)
+      cask "scroll-reverser" # Different scroll style for mouse vs. trackpad
+      cask "notunes" # Don't launch Apple Music with the play button
+      cask "topnotch" # Darkens the menu bar to complete black
+      cask "ghostty" # Terminal application (not buildable on Nix on macOS)
+      cask "discord" # nixpkgs bundle breaks its notarization seal on macOS 26+
+
+      # Mac App Store apps (requires 'mas' CLI, optional)
+      # mas "Tailscale", id: 1475387142
+    '';
+
+    # Add homebrew paths to CLI path
+    home.sessionPath = [
+      "/opt/homebrew/bin/"
+      "/opt/homebrew/opt/trash/bin"
+    ];
+
+    programs.fish.shellAbbrs.t = "trash";
+
+    home.activation.backendBrewBundle = /* bash */ ''
+      # Requires Homebrew to be installed
+      if ! /usr/bin/xcode-select --version 2>/dev/null; then
+        $DRY_RUN_CMD /usr/bin/xcode-select --install
+      fi
+      if ! /opt/homebrew/bin/brew --version 2>/dev/null; then
+        $DRY_RUN_CMD /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+      fi
+
+      verboseEcho "Syncing Homebrew dependencies via Brewfile..."
+
+      # Ensure Homebrew is in the PATH for the script (Apple Silicon path)
+      export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+      # Keep activation deterministic and non-interactive. Without this, brew
+      # auto-updates (git-fetches its taps) which can hang forever when there
+      # is no TTY (network stall, credential prompt, or a leftover brew lock).
+      export HOMEBREW_NO_AUTO_UPDATE=1
+      export HOMEBREW_NO_ENV_HINTS=1
+
+      # Point brew at the generated Brewfile in the Nix store directly. This
+      # avoids depending on the ~/.Brewfile symlink being linked first, and
+      # sidesteps the --global vs. inherited HOMEBREW_BUNDLE_FILE conflict.
+      unset HOMEBREW_BUNDLE_FILE
+      brewfile="${config.home.file.".Brewfile".source}"
+
+      if command -v brew &> /dev/null; then
+        # Install/upgrade everything declared in the Brewfile...
+        $DRY_RUN_CMD brew bundle install --file="$brewfile"
+        # ...then uninstall anything NOT listed (replaces deprecated --cleanup).
+        $DRY_RUN_CMD brew bundle cleanup --file="$brewfile" --force
+      else
+        verboseEcho "Warning: Homebrew not found. Actions skipped."
+      fi
+
+
+    '';
+
+  };
+}

platforms/home-manager/modules/nmasur/presets/programs/noti.nix

@@ -15,10 +15,21 @@ in
 
   config = lib.mkIf (cfg.enable && (pkgs.stdenv.isDarwin || config.services.dunst.enable)) {
     home.packages = [ pkgs.noti ];
-    programs.fish.shellAbbrs = {
+    programs.fish = {
+      shellAbbrs = {
         # Add noti for ghpr in Darwin
         ghpr = lib.mkForce "gh pr create && sleep 3 && noti gh run watch";
         grw = lib.mkForce "noti gh run watch";
       };
+      functions = {
+        gh-run = {
+          body =
+            lib.mkForce # fish
+              ''
+                ${lib.getExe pkgs.zellij} action new-pane --start-suspended -- noti gh run watch
+              '';
+        };
+      };
+    };
   };
 }

platforms/home-manager/modules/nmasur/presets/programs/zellij.nix

@@ -34,7 +34,24 @@ in
           # description = "Open a session in Zellij";
           body = # fish
             ''
-              set TARGET_DIR $(zoxide query --interactive)
+              set TARGET_DIR $( \
+                zoxide query --list --score | \
+                fzf --filter="$query" --no-sort | \
+                fzf \
+                  --prompt="zoxide > " \
+                  --nth=2.. \
+                  --ansi \
+                  --height=60% \
+                  --info=inline \
+                  --border=rounded \
+                  --layout=reverse \
+                  --preview-window=down:40%:wrap \
+                  --preview='ls -F -C --color=always {2..}' \
+                  --bind 'ctrl-z:ignore,btab:up,tab:down,enter:become:echo {2..}' \
+                  --cycle \
+                  --keep-right \
+                  --tabstop=1 \
+              )
               if test -z $TARGET_DIR
                 return 0
               end
@@ -92,6 +109,10 @@ in
 
       settings = {
         default_mode = "locked";
+        # Spawn fish directly instead of trusting $SHELL, which inherits the
+        # macOS login shell. On darwin that login shell is no longer managed by
+        # nix-darwin, so $SHELL can point at a stale /run/current-system path.
+        default_shell = lib.getExe pkgs.fish;
         # default_layout = "compact-top";
         # Remove border
         pane_frames = false;

platforms/home-manager/modules/nmasur/presets/services/darwin-settings.nix

@@ -0,0 +1,93 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.services.darwin-settings;
+in
+
+{
+
+  options.nmasur.presets.services.darwin-settings.enable = lib.mkEnableOption "macOS settings";
+
+  config = lib.mkIf cfg.enable {
+
+    targets.darwin.defaults = {
+      NSGlobalDomain = {
+
+        # Set to dark mode
+        AppleInterfaceStyle = "Dark";
+
+        # Don't change from dark to light automatically
+        # AppleInterfaceSwitchesAutomatically = false;
+
+        # Enable full keyboard access for all controls (e.g. enable Tab in modal dialogs)
+        AppleKeyboardUIMode = 3;
+
+        # Expand save panel by default
+        NSNavPanelExpandedStateForSaveMode = true;
+
+        # Expand print panel by default
+        PMPrintingExpandedStateForPrint = true;
+
+        # Replace press-and-hold with key repeat
+        ApplePressAndHoldEnabled = false;
+
+        # Set a fast key repeat rate
+        KeyRepeat = 2;
+
+        # Shorten delay before key repeat begins
+        InitialKeyRepeat = 12;
+
+        # Disable autocorrect capitalization
+        NSAutomaticCapitalizationEnabled = false;
+
+        # Disable autocorrect smart dashes
+        NSAutomaticDashSubstitutionEnabled = false;
+
+        # Disable autocorrect adding periods
+        NSAutomaticPeriodSubstitutionEnabled = false;
+
+        # Disable autocorrect smart quotation marks
+        NSAutomaticQuoteSubstitutionEnabled = false;
+
+        # Disable autocorrect spellcheck
+        NSAutomaticSpellingCorrectionEnabled = false;
+      };
+
+      "com.apple.LaunchServices" = {
+        # Disable "Are you sure you want to open" dialog
+        LSQuarantine = false;
+      };
+
+      # Where to save screenshots
+      "com.apple.screencapture" = {
+        location = "~/Downloads";
+      };
+
+      # Disable disk image verification
+      "com.apple.frameworks.diskimages" = {
+        skip-verify = true;
+        skip-verify-locked = true;
+        skip-verify-remote = true;
+      };
+      # Require password immediately after screen saver begins
+      "com.apple.screensaver" = {
+        askForPassword = 1;
+        askForPasswordDelay = 0;
+      };
+
+    };
+
+    targets.darwin.currentHostDefaults = {
+      "com.apple.mouse.tapBehavior" = {
+        # Disable trackpad tap to click
+        Clicking = false;
+      };
+
+    };
+
+  };
+}

platforms/home-manager/modules/nmasur/presets/services/dock.nix

@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.services.dock;
+
+  # macOS stores persistent-apps as an array of dicts, not strings.
+  # nix-darwin's dock module did this transform for us; targets.darwin.defaults
+  # writes values verbatim, so we build the tile dicts ourselves.
+  mkDockApp = path: {
+    tile-data.file-data = {
+      _CFURLString = path;
+      _CFURLStringType = 0;
+    };
+  };
+in
+
+{
+
+  options.nmasur.presets.services.dock.enable = lib.mkEnableOption "macOS Dock";
+
+  config = lib.mkIf cfg.enable {
+
+    targets.darwin.defaults = {
+      "com.apple.dock" = {
+        magnification = true;
+        largesize = 48;
+
+        # Automatically show and hide the dock
+        autohide = true;
+
+        # Add translucency in dock for hidden applications
+        showhidden = true;
+
+        # Enable spring loading on all dock items
+        enable-spring-load-actions-on-all-items = true;
+
+        # Highlight hover effect in dock stack grid view
+        mouse-over-hilite-stack = true;
+
+        mineffect = "genie";
+        orientation = "bottom";
+        show-recents = false;
+        tilesize = 44;
+
+        persistent-apps = map mkDockApp [
+          "/Applications/1Password.app"
+          "${pkgs.slack}/Applications/Slack.app"
+          "/System/Applications/Calendar.app"
+          "${pkgs.firefox-unwrapped}/Applications/Firefox.app"
+          "/System/Applications/Messages.app"
+          "/System/Applications/Mail.app"
+          "/Applications/zoom.us.app"
+          "${config.programs.ghostty.package}/Applications/Ghostty.app"
+          # Discord comes from Homebrew on macOS: the nixpkgs bundle is
+          # modified in place, breaking its notarization seal, so macOS 26+
+          # refuses to launch it ("damaged"). See presets/programs/homebrew.nix.
+          "/Applications/Discord.app"
+          "${pkgs.obsidian}/Applications/Obsidian.app"
+          "${pkgs.thunderbird}/Applications/Thunderbird.app"
+        ];
+      };
+    };
+
+    # Automatically reload the Dock and Finder when Home Manager switches
+    home.activation = {
+      reloadMacSettings = config.lib.dag.entryAfter [ "writeBoundary" ] ''
+        verboseEcho "Restarting macOS desktop services..."
+        run /usr/bin/killall Dock Finder || true
+      '';
+    };
+
+  };
+}

platforms/home-manager/modules/nmasur/presets/services/finder.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.services.finder;
+in
+
+{
+
+  options.nmasur.presets.services.finder.enable = lib.mkEnableOption "macOS Finder options";
+
+  config = lib.mkIf cfg.enable {
+    targets.darwin.defaults = {
+      "com.apple.finder" = {
+        # Default Finder window set to column view
+        FXPreferredViewStyle = "clmv";
+
+        # Finder search in current folder by default
+        FXDefaultSearchScope = "SCcf";
+
+        # Disable warning when changing file extension
+        FXEnableExtensionChangeWarning = false;
+
+        # Allow quitting of Finder application
+        QuitMenuItem = true;
+
+        # Disable the warning before emptying the Trash
+        WarnOnEmptyTrash = false;
+
+      };
+
+      NSGlobalDomain = {
+
+        # Save to local disk by default, not iCloud
+        NSDocumentSaveNewDocumentsToCloud = false;
+
+      };
+
+      # Avoid creating .DS_Store files on network or USB volumes
+      "com.apple.desktopservices" = {
+        DSDontWriteNetworkStores = true;
+        DSDontWriteUSBStores = true;
+      };
+    };
+
+  };
+}

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/Spoons/Launcher.spoon/init.lua

@@ -57,7 +57,7 @@ function obj:init()
     self.launcher:bind("ctrl", "space", function() end)
     self.launcher:bind("", "return", function()
         -- self:switch("@wezterm@")
-        self:switch("/Applications/Ghostty.app")
+        self:switch("@ghostty@")
     end)
     self.launcher:bind("", "C", function()
         self:switch("Calendar.app")

platforms/home-manager/modules/nmasur/presets/services/hammerspoon/default.nix

@@ -7,6 +7,7 @@
 
 let
   cfg = config.nmasur.presets.services.hammerspoon;
+  # inherit (config.nmasur.settings) username;
 in
 
 {
@@ -15,14 +16,26 @@ in
     lib.mkEnableOption "Hammerspoon macOS automation";
 
   config = lib.mkIf cfg.enable {
+
+    home.file.".Brewfile".text = /* homebrew */ ''
+      cask "hammerspoon" # Different scroll style for mouse vs. trackpad
+    '';
+
+    targets.darwin.defaults = {
+      "org.hammerspoon.Hammerspoon" = {
+        MJConfigFile = "${config.xdg.configHome}/hammerspoon/init.lua";
+      };
+    };
+
     xdg.configFile."hammerspoon/init.lua".source = ./init.lua;
     xdg.configFile."hammerspoon/Spoons/ControlEscape.spoon".source = ./Spoons/ControlEscape.spoon;
     xdg.configFile."hammerspoon/Spoons/DismissAlerts.spoon".source = ./Spoons/DismissAlerts.spoon;
     xdg.configFile."hammerspoon/Spoons/Launcher.spoon/init.lua".source =
       pkgs.replaceVars ./Spoons/Launcher.spoon/init.lua
         {
-          discord = "${pkgs.discord}/Applications/Discord.app";
+          discord = "Discord.app";
           firefox = "${pkgs.firefox-unwrapped}/Applications/Firefox.app";
+          ghostty = "${pkgs.ghostty-bin}/Applications/Ghostty.app";
           obsidian = "${pkgs.obsidian}/Applications/Obsidian.app";
           slack = "${pkgs.slack}/Applications/Slack.app";
           wezterm = "${pkgs.wezterm}/Applications/WezTerm.app";
@@ -32,9 +45,18 @@ in
     xdg.configFile."hammerspoon/Spoons/HideZoomWindow.spoon".source = ./Spoons/HideZoomWindow.spoon;
 
     home.activation.reloadHammerspoon = config.lib.dag.entryAfter [ "writeBoundary" ] ''
-      $DRY_RUN_CMD /Applications/Hammerspoon.app/Contents/Frameworks/hs/hs -c "hs.reload()"
+      # The `hs` CLI blocks forever on Hammerspoon's IPC message port when the
+      # app isn't running (|| true can't help — it never returns). Only reload
+      # when the app is actually up, and wrap each call in `timeout` as a hard
+      # backstop so activation can never hang even if IPC is unresponsive.
+      hs=/Applications/Hammerspoon.app/Contents/Frameworks/hs/hs
+      if /usr/bin/pgrep -x Hammerspoon > /dev/null 2>&1; then
+        $DRY_RUN_CMD ${pkgs.coreutils}/bin/timeout 10 "$hs" -c "hs.reload()" || true
         $DRY_RUN_CMD sleep 1
-      $DRY_RUN_CMD /Applications/Hammerspoon.app/Contents/Frameworks/hs/hs -c "hs.console.clearConsole()"
+        $DRY_RUN_CMD ${pkgs.coreutils}/bin/timeout 10 "$hs" -c "hs.console.clearConsole()" || true
+      else
+        verboseEcho "Hammerspoon not running; skipping reload."
+      fi
     '';
   };
 

platforms/home-manager/modules/nmasur/presets/services/menubar.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.services.menubar;
+in
+
+{
+
+  options.nmasur.presets.services.menubar.enable = lib.mkEnableOption "macOS menubar settings";
+
+  config = lib.mkIf cfg.enable {
+
+    home.packages = [
+      pkgs.ice-bar # Menu bar hiding
+    ];
+
+    targets.darwin.defaults = {
+      NSGlobalDomain = {
+
+        # Only hide menu bar in fullscreen
+        _HIHideMenuBar = false;
+
+        NSStatusItemSelectionPadding = 6;
+        NSStatusItemSpacing = 6;
+
+      };
+
+      "com.apple.menuextra.clock" = {
+        # Show seconds on the clock
+        ShowSeconds = true;
+
+        FlashDateSeparator = false;
+      };
+
+      "leits.MeetingBar" = {
+        eventTimeFormat = ''"show"'';
+        eventTitleFormat = ''"none"'';
+        eventTitleIconFormat = ''"iconCalendar"'';
+        slackBrowser = ''{"deletable":true,"arguments":"","name":"Slack","path":""}'';
+        zoomBrowser = ''{"deletable":true,"arguments":"","name":"Zoom","path":""}'';
+        teamsBrowser = ''{"deletable":true,"arguments":"","name":"Teams","path":""}'';
+        KeyboardShortcuts_joinEventShortcut = ''{"carbonModifiers":6400,"carbonKeyCode":38}'';
+        timeFormat = ''"12-hour"'';
+      };
+    };
+
+  };
+}

platforms/home-manager/modules/nmasur/profiles/darwin-base.nix

@@ -17,33 +17,23 @@ in
 
     nmasur.presets = {
       fonts.enable = lib.mkDefault true;
-      services.hammerspoon.enable = lib.mkDefault true;
-      programs.nixpkgs-darwin.enable = lib.mkDefault true;
-      programs.mpv.enable = lib.mkDefault true;
+      services = {
+        darwin-settings.enable = lib.mkDefault true;
+        dock.enable = lib.mkDefault true;
+        finder.enable = lib.mkDefault true;
+        hammerspoon.enable = lib.mkDefault true;
+        menubar.enable = lib.mkDefault true;
+      };
+      programs = {
+        fish-darwin.enable = lib.mkDefault true;
+        homebrew.enable = lib.mkDefault true;
+        nixpkgs-darwin.enable = lib.mkDefault true;
+        mpv.enable = lib.mkDefault true;
+        noti.enable = lib.mkDefault true;
+      };
     };
 
     home.homeDirectory = lib.mkForce "/Users/${config.home.username}";
-
-    # Default shell setting doesn't work
-    home.sessionVariables = {
-      SHELL = "${pkgs.fish}/bin/fish";
-    };
-
-    # Used for aerc
-    xdg.enable = lib.mkDefault pkgs.stdenv.isDarwin;
-
-    programs.fish.shellAbbrs.t = "trash";
-
-    # Add homebrew paths to CLI path
-    home.sessionPath = [
-      "/opt/homebrew/bin/"
-      "/opt/homebrew/opt/trash/bin"
-    ];
-
-    home.packages = [
-      pkgs.noti # Create notifications programmatically
-      pkgs.ice-bar # Menu bar hiding
-    ];
   };
 
   # Fix for: 'Error: HOME is set to "/var/root" but we expect "/var/empty"'

platforms/home-manager/modules/nmasur/profiles/darwin-gaming.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.profiles.darwin-gaming;
+in
+
+{
+
+  options.nmasur.profiles.darwin-gaming.enable = lib.mkEnableOption "gaming config for macOS";
+
+  config = lib.mkIf cfg.enable {
+
+    home.file.".Brewfile".text = /* homebrew */ ''
+      # Casks (GUI Apps)
+      cask "steam" # Not packaged for Nix on macOS
+      cask "epic-games" # Not packaged for Nix
+    '';
+
+  };
+}

platforms/home-manager/modules/nmasur/profiles/experimental.nix

@@ -33,6 +33,7 @@ in
 
       # pkgs.crush # AI LLM Agent
       pkgs.gemini-cli # AI LLM Agent
+      pkgs.antigravity-cli # AI LLM Agent
       pkgs.pi-coding-agent # AI LLM Agent
 
     ];

platforms/home-manager/modules/nmasur/profiles/llm-development.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.nmasur.profiles.llm-development;
+in
+
+{
+
+  options.nmasur.profiles.llm-development.enable = lib.mkEnableOption "LLM coding tools";
+
+  config = lib.mkIf cfg.enable {
+
+    home.packages = [
+
+      pkgs.pi-coding-agent # AI LLM Agent
+
+    ];
+
+  };
+
+}

platforms/home-manager/modules/nmasur/profiles/work.nix

@@ -43,12 +43,20 @@ in
       pkgs.uv # Python packaging
     ];
 
+    home.file.".Brewfile".text = /* homebrew */ ''
+      # cask "1password" # 1Password will not launch from Nix on macOS
+      # cask "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
+      # cask "logitech-g-hub" # Mouse and keyboard management
+      cask "logitune" # Logitech webcam firmware
+      cask "meetingbar" # Show meetings in menu bar
+    '';
+
     programs.fish.shellAliases.ec2 = "aws-ec2";
 
     nmasur.presets = {
       fonts.enable = lib.mkDefault true;
       programs = {
-        _1password.enable = lib.mkDefault true;
+        # _1password.enable = lib.mkDefault true;
         atuin.enable = lib.mkDefault true;
         aws-ssh.enable = lib.mkDefault true;
         bash.enable = lib.mkDefault true;

platforms/nix-darwin/modules/nmasur/presets/programs/_1password.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.programs._1password;
+in
+
+{
+  options.nmasur.presets.programs._1password.enable = lib.mkEnableOption "1Password password manager";
+
+  config = lib.mkIf cfg.enable {
+    # Unfree packages are already permitted via the shared nixpkgs instance
+    # created in lib/default.nix (config.allowUnfree = true). Setting
+    # nixpkgs.config here would conflict with nixpkgs.pkgs being set externally.
+    programs._1password.enable = true;
+    programs._1password-gui = {
+      enable = true;
+      # Certain features, including CLI integration and system authentication support,
+      # require enabling PolKit integration on some desktop environments (e.g. Plasma).
+      # polkitPolicyOwners = [ "yourUsernameHere" ];
+    };
+  };
+}

platforms/nix-darwin/modules/nmasur/presets/services/dock.nix

@@ -50,7 +50,10 @@ in
         "/System/Applications/Mail.app"
         "/Applications/zoom.us.app"
         "/Applications/Ghostty.app"
-        "${pkgs.discord}/Applications/Discord.app"
+        # Discord comes from Homebrew on macOS: the nixpkgs bundle is modified
+        # in place, breaking its notarization seal, so macOS 26+ refuses to
+        # launch it ("damaged").
+        "/Applications/Discord.app"
         "${pkgs.obsidian}/Applications/Obsidian.app"
         "${pkgs.thunderbird}/Applications/Thunderbird.app"
       ];

platforms/nix-darwin/modules/nmasur/presets/services/settings.nix

@@ -25,76 +25,76 @@ in
         enableKeyMapping = true; # Allows for skhd
       };
 
-      defaults = {
-        NSGlobalDomain = {
+      # defaults = {
+      #   NSGlobalDomain = {
 
-          # Set to dark mode
-          AppleInterfaceStyle = "Dark";
+      #     # Set to dark mode
+      #     AppleInterfaceStyle = "Dark";
 
-          # Don't change from dark to light automatically
-          # AppleInterfaceSwitchesAutomatically = false;
+      #     # Don't change from dark to light automatically
+      #     # AppleInterfaceSwitchesAutomatically = false;
 
-          # Enable full keyboard access for all controls (e.g. enable Tab in modal dialogs)
-          AppleKeyboardUIMode = 3;
+      #     # Enable full keyboard access for all controls (e.g. enable Tab in modal dialogs)
+      #     AppleKeyboardUIMode = 3;
 
-          # Expand save panel by default
-          NSNavPanelExpandedStateForSaveMode = true;
+      #     # Expand save panel by default
+      #     NSNavPanelExpandedStateForSaveMode = true;
 
-          # Expand print panel by default
-          PMPrintingExpandedStateForPrint = true;
+      #     # Expand print panel by default
+      #     PMPrintingExpandedStateForPrint = true;
 
-          # Replace press-and-hold with key repeat
-          ApplePressAndHoldEnabled = false;
+      #     # Replace press-and-hold with key repeat
+      #     ApplePressAndHoldEnabled = false;
 
-          # Set a fast key repeat rate
-          KeyRepeat = 2;
+      #     # Set a fast key repeat rate
+      #     KeyRepeat = 2;
 
-          # Shorten delay before key repeat begins
-          InitialKeyRepeat = 12;
+      #     # Shorten delay before key repeat begins
+      #     InitialKeyRepeat = 12;
 
-          # Disable autocorrect capitalization
-          NSAutomaticCapitalizationEnabled = false;
+      #     # Disable autocorrect capitalization
+      #     NSAutomaticCapitalizationEnabled = false;
 
-          # Disable autocorrect smart dashes
-          NSAutomaticDashSubstitutionEnabled = false;
+      #     # Disable autocorrect smart dashes
+      #     NSAutomaticDashSubstitutionEnabled = false;
 
-          # Disable autocorrect adding periods
-          NSAutomaticPeriodSubstitutionEnabled = false;
+      #     # Disable autocorrect adding periods
+      #     NSAutomaticPeriodSubstitutionEnabled = false;
 
-          # Disable autocorrect smart quotation marks
-          NSAutomaticQuoteSubstitutionEnabled = false;
+      #     # Disable autocorrect smart quotation marks
+      #     NSAutomaticQuoteSubstitutionEnabled = false;
 
-          # Disable autocorrect spellcheck
-          NSAutomaticSpellingCorrectionEnabled = false;
-        };
+      #     # Disable autocorrect spellcheck
+      #     NSAutomaticSpellingCorrectionEnabled = false;
+      #   };
 
-        # Disable "Are you sure you want to open" dialog
-        LaunchServices.LSQuarantine = false;
+      #   # Disable "Are you sure you want to open" dialog
+      #   LaunchServices.LSQuarantine = false;
 
-        # Disable trackpad tap to click
-        trackpad.Clicking = false;
+      #   # Disable trackpad tap to click
+      #   trackpad.Clicking = false;
 
-        # Where to save screenshots
-        screencapture.location = "~/Downloads";
+      #   # Where to save screenshots
+      #   screencapture.location = "~/Downloads";
 
-        CustomUserPreferences = {
-          # Disable disk image verification
-          "com.apple.frameworks.diskimages" = {
-            skip-verify = true;
-            skip-verify-locked = true;
-            skip-verify-remote = true;
-          };
-          # Require password immediately after screen saver begins
-          "com.apple.screensaver" = {
-            askForPassword = 1;
-            askForPasswordDelay = 0;
-          };
-        };
+      #   CustomUserPreferences = {
+      #     # Disable disk image verification
+      #     "com.apple.frameworks.diskimages" = {
+      #       skip-verify = true;
+      #       skip-verify-locked = true;
+      #       skip-verify-remote = true;
+      #     };
+      #     # Require password immediately after screen saver begins
+      #     "com.apple.screensaver" = {
+      #       askForPassword = 1;
+      #       askForPasswordDelay = 0;
+      #     };
+      #   };
 
-        CustomSystemPreferences = {
+      #   CustomSystemPreferences = {
 
-        };
-      };
+      #   };
+      # };
 
       # # Settings that don't have an option in nix-darwin
       # activationScripts.postActivation.text = ''

platforms/nix-darwin/modules/nmasur/profiles/base.nix

@@ -18,30 +18,31 @@ in
 
     nmasur.presets = {
       programs = {
+        _1password.enable = lib.mkDefault true;
         fish.enable = lib.mkDefault true;
-        homebrew.enable = lib.mkDefault true;
+        # homebrew.enable = lib.mkDefault true;
       };
       services = {
-        daily-summary.enable = lib.mkDefault false;
-        dock.enable = lib.mkDefault true;
-        finder.enable = lib.mkDefault true;
-        hammerspoon.enable = lib.mkDefault true;
-        menubar.enable = lib.mkDefault true;
+        # daily-summary.enable = lib.mkDefault false;
+        # dock.enable = lib.mkDefault true;
+        # finder.enable = lib.mkDefault true;
+        # hammerspoon.enable = lib.mkDefault true;
+        # menubar.enable = lib.mkDefault true;
         nix.enable = lib.mkDefault true;
         settings.enable = lib.mkDefault true;
         user.enable = lib.mkDefault true;
       };
     };
 
-    homebrew.brews = [
-      "trash" # Delete files and folders to trash instead of rm
-    ];
-    homebrew.casks = [
-      "scroll-reverser" # Different scroll style for mouse vs. trackpad
-      "notunes" # Don't launch Apple Music with the play button
-      "topnotch" # Darkens the menu bar to complete black
-      "ghostty" # Terminal application (not buildable on Nix on macOS)
-    ];
+    # homebrew.brews = [
+    #   "trash" # Delete files and folders to trash instead of rm
+    # ];
+    # homebrew.casks = [
+    #   "scroll-reverser" # Different scroll style for mouse vs. trackpad
+    #   "notunes" # Don't launch Apple Music with the play button
+    #   "topnotch" # Darkens the menu bar to complete black
+    #   "ghostty" # Terminal application (not buildable on Nix on macOS)
+    # ];
 
   };
 }

platforms/nix-darwin/modules/nmasur/profiles/work.nix

@@ -16,12 +16,12 @@ in
 
     nmasur.profiles.base.enable = lib.mkDefault true;
 
-    homebrew.casks = [
-      "1password" # 1Password will not launch from Nix on macOS
-      # "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
-      # "logitech-g-hub" # Mouse and keyboard management
-      "logitune" # Logitech webcam firmware
-      "meetingbar" # Show meetings in menu bar
-    ];
+    # homebrew.casks = [
+    #   "1password" # 1Password will not launch from Nix on macOS
+    #   # "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
+    #   # "logitech-g-hub" # Mouse and keyboard management
+    #   "logitune" # Logitech webcam firmware
+    #   "meetingbar" # Show meetings in menu bar
+    # ];
   };
 }

platforms/nixos/modules/nmasur/presets/services/calibre-web.nix

@@ -36,6 +36,11 @@ in
       };
     };
 
+    # metadata.db lives in /var/lib/calibre-web-db and is symlinked into the
+    # library dir; ProtectSystem=strict in the upstream module blocks writes
+    # through symlinks unless the real target path is also listed.
+    systemd.services.calibre-web.serviceConfig.ReadWritePaths = [ "/var/lib/calibre-web-db" ];
+
     # Allow web traffic to Caddy
     nmasur.presets.services.caddy.routes = [
       {

platforms/nixos/modules/nmasur/presets/services/mealie.nix

@@ -20,6 +20,9 @@ in
       };
     };
 
+    # Fix BASE_URL for downloading backups
+    systemd.services.mealie.environment.BASE_URL = lib.mkForce "https://${hostnames.recipes}";
+
     nmasur.presets.services.caddy.routes = [
       {
         match = [ { host = [ hostnames.recipes ]; } ];